Reverse-engineering some Litton military boards

[D Straney]

Got lucky a few months ago and ended up with some beautiful boards from the 90's with lots of ceramic & gold plating.

No direct info on where they originally were used, but I saw a different one with the same CAGE code (09691) marked "Litton".  This CAGE code now refers to "L3Harris", and a location in Halifax, which means this was originally "Litton Systems Canada", and likely at some point "Northrop Grumman Electro-Optical Systems" - my previous note on "the big, dumb game of military-industrial-complex trading cards" applies here too.  From doing some quick searches on all these companies, though, it seems like there's a good chance they were used in imaging or display - reading data from an IR or visible-light camera, doing some image processing, then displaying/transmitting/storing it.  With that in mind, let's look more closely at...

Analog input board


I'm calling this the "analog input board" because of the analog signal chains feeding analog-to-digital converters.  You can see the 3 repeated channels at the top, a digital & timing section at the bottom, and a common section with a lot of comparators at the right-hand edge.

The PCB is screwed to an aluminum reinforcement plate, with cutouts for all the through-hole pins that protrude through the board.  This plate holds the mounting bars down the sides which secure it in place, and provides a combination of mechanical stiffness to resist vibration, and a bit of heatsinking as well.


Let's walk through the sections one by one:

Clocks & timing
The metal cans hold a 15 Mhz oscillator, and two which are probably delay lines.  The top delay line has a part number of M83532/03D002, which is similar to the M83532/03D003B of 10x 3µs steps.  This part is listed as "electromechanical", which may mean a SAW filter.  The bottom delay line is made by the same company, Hytek; I haven't been able to find references to the part number "8022078", but it seems likely this is also a delay line.  I'm planning on removing the lids from both metal cans to see inside at some point.

The DIP IC is the 74HCT7046 PLL, which seems like a higher-speed version of the classic 4000-series-CMOS 4046 PLL; the nominal VCO frequency is ~18 Mhz.  The PLL has two TLC2201 op-amps next to it (the black squares), which handle the control loop filtering and compensation.  One of the PLL's inputs (pin 5, COMP IN) comes from the probable-delay-line, and so it seems likely that this PLL is producing a copy/multiple/division of the 15 Mhz clock with programmable phase delay, maybe for creating a separate ADC data-I/O clock.



Digital control
Running the whole show, from the center, is a mystery IC with a lot of pins.

I couldn't find any references to the part number, but I suspect it's an FPGA, possibly made by Xilinx.  The important clue here is the small IC marked "1765" with a Xilinx logo:

This is a Xilinx XC1765 configuration memory, meant to store bitstream data and load it into a Xilinx FPGA.  The empty DIP socket nearby may be either an in-circuit programming connection, or a spot for removable configuration memory during development.  The female pin headers nearby also may be for digital debugging connections.

Analog channels
The journey starts at a connector mounted to the rear side of the board, where the input signals enter:

...before being processed and digitized by the repeated circuit sections as shown earlier:



I traced the channel circuitry with a combination of overlaid front- and back-side photos, and a few continuity tests with sewing needles to pierce the conformal coating, where the traces went under components or on an inner PCB layer.  The non-uniformity of the PCB-trace routing across all 3 channels actually helped me here: interestingly, all 3 channels have the same component positioning, but the traces are routed differently on each channel.  I don't think there would be any good reason to do this intentionally, so I assume it was a limitation of the CAD tools being used, or of the engineers using them.

Each channel actually has 2 separate differential input pairs on the input connector.  Each differential input pair has a termination resistor, and is AC-coupled (through large tantalum caps) to a differential receiver, possibly with gain.  An analog switch then selects between each of the two inputs, a test signal (we'll talk more about that later), or 0V.

After this it gets weirder.  The selected input signal goes to a non-inverting op-amp with gain; however, the reference point (normally, ground) for this op-amp's feedback voltage divider is the output of a sample-and-hold (S&H) IC.  This IC, the HA-5330, has an op-amp on the input so that it can be configured as a voltage follower taking its feedback from the output of the S&H, as it is here - this means that when the "sample" switch is closed, the HA-5330's op-amp compensates for any offset voltages or non-linearities in the sample-and-hold circuit itself, and the rest of the downstream on-chip circuitry.
Anyways, the S&H seems to be used to do some kind of offset correction, by sampling the input signal at some time determined by the FPGA, and afterwards subtracting that offset from the input signal.

Finally, the signal goes through an inversion, with a programmable DC offset added (we'll talk about that later too), and then enters an ADC, whose digital output goes to the FPGA.  The two parallel diodes clamp the signal if it goes positive; for some reason, a negative reference voltage & negative-only signal are fed to the ADC.  The AD9048 is an 8-bit ADC which can sample at 35 Msps, and the AD827 op-amps used throughout have a 50 Mhz bandwidth - this suggests to me that the analog signals being processed & digitized are somewhere in the 1-10 Mhz range.  These could be video readout signals received from an image sensor, or maybe downconverted IF signals from a radar receiver.  If these are video signals, then the dynamic-offset-correction with the sample-and-hold could be to sample the "black level" from the covered pixels at the edge of the image sensor, and use that as a reference point for the rest of the row of pixels.

Right-hand common section


This section contains 3 high-speed (2.5 ns) LM160 comparators - these compare signals from various points, in the right-most channel only, against thresholds.  The digital outputs are all routed to the FPGA to signal...something.

• The top third takes the un-modified input signal, and level-shifts it (with the series cap & 0V clamp) so that the most negative peak of the input signal becomes 0V.  There's no resistor or analog switch to discharge the series cap over a long timescale, which is surprising to me - maybe it relies on the tantalum's leakage to reset it eventually (although that seems wildly sketchy).  This level-shifted signal is then multiplied by a gain stage, and compared against a fixed threshold.
• The middle third takes the input signal with the S&H-dynamic-offset applied, inverts it (possibly with gain), and clamps it to 0V minimum.  This is then compared against the same fixed threshold as the top third.
• The bottom third takes the input signal to the channel's ADC, which has gone through additional inversion and programmable DC offset.  This is then AC-coupled (which removes the programmable DC offset) with a trimmable corner frequency, multiplied by a trimmable gain, and compared against a trimmable threshold.  All 3 trimmers visible in the right-hand section are used here; each one has an empty resistor footprint next to it, presumably so that the trimmer can be replaced with a fixed resistor.  Even with the shafts glued in place, the way these trimmers are mounted to the board doesn't seem particularly robust against shock or vibration, so I wouldn't be surprised if this board was an engineering model.

As for purpose: if this board digitizes video signals, then these likely detect the start of a line of video and/or specific sync pulses.  If this board digitizes downconverted radar return signals, then these probably detect the start of a return pulse.  They also might just be here to detect saturation in any of the analog stages leading up to the ADC, to warn the processing system that the input data isn't reliable.  I've worked on an industrial data acquisition system where we realized after the first prototype that we very much needed some saturation detection at various points in our programmable-gain analog signal chain.

The combined gain-and-clamp circuit in the middle third is slightly unusual and deserves a separate look:

• When the output signal is positive: D5 is reverse-biased, and D4 is forward-biased.  The op-amp works in a normal inverting configuration, except it can only source current because of D4; it can't sink current.
• When the output signal "tries" to go negative: D4 becomes reverse-biased, and this breaks the op-amp's feedback path.  The output voltage decreases until D5 is forward-biased, and once D5 conducts, this forms a new feedback loop around the op-amp.  The output now sits at about -0.7V, and maintains the "-" input at 0V by sinking current through D5, to match the 0V "+" input.  If the input polarity reverses, then the op-amp output goes positive and it goes back to the previous "positive output" state.

D5's purpose is to speed up the response of the clamp circuit.  If D5 weren't there, then when the output tried to go negative, the op-amp would send its output all the way to the negative rail and saturate there (breaking the control loop).  This would make for a long recovery time when the signal went back into a valid range, as the op-amp would have to bring its internal transistors out of saturation (which incurs the storage time penalty for bipolars) and slew its output all the way from the negative rail back up to >0V.  Instead, with D5, the op-amp's control loop stays in regulation, and the output sits just below 0V, ready to recover quickly and set a positive output again.

Bottom common section


The bottom half of the schematic shows the high-speed DAC which generates the AC test signal, that feeds all channels on input 3 of their analog switches.  The DAC08 has a current output, so U19A is used as a transimpedance amplifier to convert that to a voltage.

The top half shows the AD7569, an "analog I/O system" with an ADC, DAC, and switchable gain.  The DAC part of this is straightforward: it generates a DC offset (inverted by U17) which is used to set the programmable offset voltage on every channel, which is added to the signal just before the channel's ADC.
The ADC part is a little stranger though - the ADC takes its analog input from the middle third of the comparator section shown previously.  This is strange because the signal fed to the comparator is reasonably high-bandwidth, with the 50 Mhz op-amps & 35 Msps ADC in the signal chain.   This ADC though, on the AD7569, is comparatively slow at 500 ksps, and so can't reliably sample the full signal bandwidth.  I'm guessing that this is used to read idle DC levels, or something similar.


Anyways, hope this was interesting.  Let me know if you have any more info or speculation to add.

[peter-h]

Amazing work!

Another milspec "cost no object" job from nearly 30 year ago.

That machined supporting plate with the holes to clear any PTH legs on the PCB, is a work of art. This was probably not a ground based product. Maybe a missile or similar.

[inse]

I wonder about the botch work on the CPU board, it’s done so precisely, you even can’t call it botch work.
The socket on the analog input board surprised me when the entire design was made to withstand vibration.
What are you trying to achieve with your investigations?
I guess that there are a lot of specific parts being used where no information was made available.

[Psi]

Don't let a gold recovery expert near that thing, they will start salivating and it will disappear soon after.

Those old ceramic milspec packages are jam packed full of thick gold bond wires and solid gold braiding under the die's. All the plating is probably extremely thick hard-gold as well.

[D Straney]

I wonder about the botch work on the CPU board, it’s done so precisely, you even can’t call it botch work.

Yeah the CPU board rework is crazy!  I've done plenty of painful reworks myself on prototypes but nothing approaching that scale, and that quality.  Can only imagine how many hours it took some technician (hopefully highly-paid for their skills).

What are you trying to achieve with your investigations?

Definitely not re-use   Not looking to assemble an aircraft radar in my living room or anything like that.  Just trying to figure out what each board does, and how it works: it's a lot of fun for me to do "electronics detective work" like with Bunnie's Name That Ware series.  Plus since the electronics I've developed at my jobs is relatively normal research/consumer/industrial stuff, I'm always interested in learning things about the design choices (electrical, sourcing, and physical) that go into unusual things most people don't get to see, like medical implants, military & aerospace electronics, super high-end test equipment (got a couple scrapped Teradyne boards), etc.

[schmitt trigger]

Very interesting, thanks for sharing.

I find amusing the combination of what appears to be fine pitch SMT and a TO3 device in the same board!

[squadchannel]

Gorgeous as Adlib Gold.

[peter-h]

The socket is probably for an EPROM or some such, for initialising the board in production.

[inse]

Thats a challenge for sure, you neither know exactly what the purpose of the boards was nor will you be able to find any documentation on the “number only“ chips from 30 years ago.
Was just reminded of an electronics surplus dealer selling also decommissioned military electronic equipment “for tinkerers, but don’t even think of asking for documentation“

[5U4GB]

The socket on the analog input board surprised me when the entire design was made to withstand vibration.

It may be a bit of a red herring, I've worked on stuff where someone decided that it had to withstand vibration not because it was going to be deployed into such an environment but because there was no guarantee that it might not at some unforeseeable time in the future be deployed somewhere where there might be vibration.

The thing ended up being built like a tank, or would have been if it hadn't been cancelled due to cost and schedule overruns.  Beautiful piece of engineering though.

[5U4GB]

Was just reminded of an electronics surplus dealer selling also decommissioned military electronic equipment “for tinkerers, but don’t even think of asking for documentation“

Particularly when you get boards where some of the devices are marked CCI for which a Google search on the part number/device name returns zero hits.  Then the next day you notice a black van parked outside your house.

[xrunner]

Beautiful pictures!

What am I looking at in this screen shot on one of the boards - a test point?

[D Straney]

Hah seriously.  I appreciate the cryptomuseum.com people handling that kind of thing for the rest of us.

Beautiful pictures!
What am I looking at in this screen shot on one of the boards - a test point?

Thanks!  Yes, those seem like test points: there's a bunch of footprints for them on the board, small through-holes with the conformal coating masked off around them, but only a few have pins populated.  They're at key points like the outputs of both differential receivers for each channel, the ADC input, comparator inputs, etc.  The fact that some are populated and some aren't again makes me suspect this might be an engineering model (or had to be sent back for repair/troubleshooting).

...nor will you be able to find any documentation on the “number only“ chips from 30 years ago.

The situation is actually not as bad as it seems on that front - there's some standard part-numbering schemes for military parts (JM38510/... and 5962-...) with searchable commercial databases, which usually turns up the non-military equivalents.  For fully-custom numbering or sparse info, either there's enough context for a good guess (such as the FPGA here, with the Xilinx configuration memory connected to it), or that means I get to have even more fun and pop the lids to look inside!  Sometimes even the bare dies are a total mystery, but often I can trace the circuit inside a hybrid module or recognize part number markings on the die (op-amps are also fairly easy to recognize in structure, even though I'm not an expert on IC reverse-engineering).

[peter-h]

Your unusual teardowns URL is dud, BTW

[D Straney]

Your unusual teardowns URL is dud, BTW

Dammit, Hackaday.  Ok good to know, thanks.  Thought they'd be an easy place to host a simple list of links online for free, but their website is constantly down and having all kinds of issues, gotta ditch them for Wordpress or something soon.

[D Straney]

Signal generator board



DACs & purpose
The most obvious feature of this board is all the large CPLDs.  However, I'm calling it the "signal generator board" because of the 5x (!!) DAC channels in the analog/mixed-signal section down the left-hand side.  To sum up:

• 200 ksps
• 2.5 Msps
• 2.5 Msps
• 10 Msps
• 10 Msps

So we have one slow channel, two moderately fast channels, and two fast channels.  The op-amps nearby probably are for filtering & scaling/offsetting the DAC outputs appropriately - the slow DAC might even provide a programmable DC offset for some of the other analog output channels.  The voltage references (2x 10V, 2.5V, and 5V) probably feed the DACs and/or create precision offsets for the op-amps to use.

The form factor and connector at the bottom look similar to the previous "analog input" board, so it could be from the same system.  I can't think of any video or imaging applications which would need single-digit-Mhz signal generation, so my best guess is that this is doing DDS generation of radar transmit pulses.  There's all sorts of ways to modulate a radar transmit pulse to improve its performance, and so generating an arbitrary transmit waveform in a programmable way would be extremely useful.  The multiple output channels might be up-converted to different transmit frequencies as part of a frequency-diversity radar system, or maybe fed to separate antennas for some very basic phased-array beam steering.

Programmable logic
Whatever the DACs' output signals do, there's a good chance their input data is fed directly from the various programmable logic on the board, both the Altera (now Intel) MAX 7000 series electrically-erasable CPLDs in the larger black-lid packages...

...and the MAX 5000 series UV-erasable CPLDs closer to the connector.

If you zoom into the image, you can see the two columns of 4 Logic Array Blocks, one at the left and one at the right, plus the global routing/clocking in the middle column.

Each of these CPLDs has 100-200 macrocells, and each macrocell consists of one register fed by the programmable input logic terms - so there's not enough programmable logic on this board to implement a soft processor, for example, but it can still do a good deal of computation & sequencing.  192 flip-flop is enough for 12x 16-bit registers, for example.


Waveform RAM
There's also a lot of RAM on this board: the 3x SMJ55161 SRAM chips here hold 768K 16-bit words total, so this probably holds waveform data for the DACs.  If you check out the datasheet, the SMJ55161 has an interesting architecture.  There's a random-access port (good for writing waveform data, in this case) and a separate serial-access port ("SAM") meant for FIFO-like continuous reads.  The SAM is specifically meant to feed a continuous stream of data to DACs for use in computer video cards; the datasheet advertises "Up to 45-MHz Uninterrupted Serial-Data Streams", and mentions...

Code: [Select]

...a split-register-transfer read (DRAM-to-SAM) feature for the serial register (SAM port)
that enables real-time-register-load implementation for continuous serial-data streams without critical timing requirements. The register is divided into a high half and a low half. While one half is being read out of the SAM port, the other half can be loaded from the memory array.This seems ideally suited for feeding a continuous stream of waveform data to the DACs, or possibly to the CPLDs first for some on-the-fly scaling or other basic math.


CPU
There's also a 68HC11 processor in the corner with its own RAM & program memory nearby:

This probably does the high-level control and sequencing, and may do the math (with the help of some of the programmable logic?) to generate the waveform data and store it in the waveform RAM we just discussed.

FIFOs & interface
A couple FIFOs (1K x 9 bits each) live next to the backplane connector:

These are likely responsible for moving data into this board from elsewhere in the system.  It's possible that the 68HC11 doesn't do any of the waveform-generation math, and instead, a different board generates the waveform data and loads it into the waveform RAM here via these FIFOs and the UV-erasable CPLDs.
You can also see a row of buffers in that photo, for digital signalling to and from the backplane connector.

Analog
The analog mux and quad comparator at the bottom-left corner may be used together, for monitoring a variety of different DC inputs for any out-of-range conditions.

Sadly, I can't trace the circuitry in the analog & mixed-signal section: unlike with the analog input board, all the traces are run on an inner layer that's hidden by a copper plane, so I don't have a good way of seeing what's connected without spending a year doing continuity checks through the conformal coating, or getting an X-ray.



Resistor arrays
I was curious what some mystery packages were (marked as "??" in the annotated board view at the beginning), which consistently turned up near the line drivers, so I popped the lid on one:


Turns out it's a resistor array, with 19 separate resistors bussed to a common terminal.

Mechanical
Also, this board, like the last one, has a thick aluminum stiffener with cutouts for all the through-hole pins and a few SMT components on the back side (especially power-filtering caps for the CPLDs).



Here's a couple final glamour shots of the board:

[SeanB]

That heavy rework on the CPU board is there because something there, likely the upside down package, was no longer available, so they had to do a revision to use another similar part, with different pin out, and likely added on the 2 transistors that are upside down to provide the needed inversion. Probably a simple PLA, very much under used, but replacing it meant using that other package and the transistors to drive external logic, and then added in a extra decoupling capacitor that was probably needed to make one of the signals a pulse edge for the logic to latch.

[coromonadalix]

thks OP   so beautifuuuuuuul   drooling

[D Straney]

Good point!  That would make a lot of sense for the CPU board reworks.

Speaking of which, let's look at that one in more detail.
CPU board



The small (right-side-up) packages marked "??" are probably resistor arrays, like the resistor arrays on the signal generator board.
Looking up the part number printed on the board actually turns up a result at commercial aerospace parts suppliers - however, the only data is that it's a "computing subassembly (CPU)".  That's...really helpful.

The circuitry on here isn't very exciting.  It's pretty straightforward, with an Intel 80C186 processor, plus an EPROM on the back for program code (I assume), and some RAM.

Some of the RAM is dual-port, which may be for easy DMA to or from the processor's memory by external equipment.


External communications is through 6x optoisolators (for discrete digital inputs/outputs) in metal cans, and a large MIL-STD-1553 transceiver module, which has 2 channels for serial communications.



The fast logic ("74F" and "74AS" series, < 5 ns propagation delay) clustered around the oscillator might have something to do with generating additional clock signals, or multiple clock phases.


There's a whole lot of buffers and latches which are probably for interfacing to an external bus.  The connector, unlike the other two boards, doesn't look like it fits into a backplane - it looks like it's meant to plug into another larger PCB as a daughterboard.


I don't know what all the programmable logic does (lots of small-ish Altera CPLDs and 2 PAL devices), but I removed the sticker for one of the EP1810 UV-erasable devices to look at the die.  You can see the uniform-looking individual logic blocks, with the many parallel wires for global routing running in between them.




Let's open up the MIL-STD-1553 module:

According to the datasheet, this is more than just a simple physical-layer transceiver plus a couple UARTs: it includes high-level message handling logic and a large buffer memory for storing messages to send and receive (I can imagine this frees up a lot of CPU time, not having to handle all the timing jobs such as waiting for the bus to be free to send a message).
The two large ICs in the middle look like logic gate arrays to sequence all these operations, while the two rainbow-reflective ICs at the left look like the RAM used as the message buffers:

The big mess of smaller silicon dies at the other end of the package must be the physical-layer transmitters and receivers:

(I haven't gotten public-worth photos of the dies yet, or identified any except for a 54HC00 quad NAND gate)

Here's another photo of the hybrid module, for good measure:

[peter-h]

Gosh this takes me back. I googled idt la55l48b and it is a 1k x 8 dual port SRAM. I used these in a token ring LAN controller I designed c. 1990. A handy chip but a total bastard to replace if it disappears. What happened to IDT? Renesas took them over: https://www.renesas.com/en/document/dst/713040-datasheet.

But these are milspec grades - probably a few hundred $ each. The build cost of that card must be of the order of $10k.

It's a whole different world, working on that stuff. Probably some sort of radar processing, image processing, etc.

[kmm]

Man these are some beautiful boards. Kinda wish I would run across a piece of scrap with one of those mil spec 80186 or 68HC11s on it to recycle into some art-tronics toy of my own design, but I don't think I could bring myself to part out a board like this in such good condition rather than just hanging it on the wall in a picture frame.

[D Straney]

Got around to opening those suspected-delay-line modules on the "analog input" board:

Didn't do a great job of it (was hoping to get the metal lid to peel away cleanly at the lower seam, which I've had great luck with on circular metal-can packages and one other rectangular one)...but you can see what's going on inside.

Both of the modules contain delay lines made out of L-C elements, like a lumped-element model of a transmission line.  The capacitances come from discrete SMT capacitors, and the inductances are (loosely?) coupled, wound on a common core mounted above the capacitors.


Both delay line modules have two ICs, in the form of bare dies.  In the "top" module, both dies are 54/74S04 or 54/74LS04 6x logic inverters.  These seem to be used both to buffer the input to the delay line, and also to buffer the outputs of the delay line at each of the 10 taps, to produce 10 separate delayed signals on their own pins.


The "bottom" module has one 54/74(L?)S04 6x logic inverter, of a slightly different revision or manufacturer.  Only two of these inverters are used (probably to buffer the input signal); the other remaining inverter inputs are tied to ground.

...and the other IC looks like a 1-of-8 multiplexer: thanks to uwezi and needsadrink|woke from the ChipChat discord channel for ID'ing this way more solidly than my vague suspicions.

There's 4 very long transistors at the bottom-right, and 4 very long transistors at the top-right, that are gating each input, by combining all the control signals and their logical complements.  The purpose of this multiplexer is to select one of the 8 delay taps for the output pin: as opposed to the other module, where all 10 delay signals are available on separate output pins simultaneously, on this module a 3-bit binary input is used to select which delay tap is directed to the single output.

[silly sausage]

nice work but i think you need to get out more! lol.